HackTool - LittleCorporal Generated Maldoc Injection

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•14

This rule detects process injection activities originating from Microsoft Word (winword.exe) that are characteristic of a LittleCorporal generated malicious document. Specifically, it looks for winword.exe as the source image performing process access, combined with a call trace that includes a .NET Framework 64-bit v2.x path and an 'UNKNOWN' module, which is indicative of injected code.